Hackers exploited a flaw in BTCPay, draining funds from Lightning Network nodes, prompting urgent upgrades from developers.
On August 8, a vulnerability in the BTCPay payment server was exploited by hackers, leading to the theft of funds from Lightning Network nodes. Developers are advising users to upgrade to version 2.4.2 of the LND software immediately or to disable their servers to prevent losses.
Currently, a critical vulnerability is being exploited on BTCPay Server, posing a significant risk to user funds.
We recommend updating your BTCPayServer to version 2.4.2 via the Admin Dashboard under Maintenance.
BTCPay facilitates direct Bitcoin transactions for merchants by integrating with the Lightning Network for smaller transactions. However, a bug linked to .macaroon files allowed unauthorized remote access, giving attackers full control over affected nodes, resulting in channel closures and fund withdrawals.
The risk is specifically tied to configurations using the LND software, which is predominant among Lightning node operators. While regular BTCPay wallets remain secured, those linked to LND may be at risk from the exploit.
The extent of the breach has not yet been fully disclosed, with the project promising an analysis in the days ahead. This vulnerability was uncovered during an AI-driven audit by the Bitcoin Red Team, which has been examining codebases in the Bitcoin ecosystem.
Foundation and Citadel21 Among Victims
At least two organizations have reported losing funds, including Foundation, a hardware wallet manufacturer. CEO Zach Herbert noted that their Lightning node was compromised overnight, though their on-chain wallet was safe.
Our Foundation node was drained overnight by attackers, but our on-chain wallet is unaffected.
Another victim, the Bitcoin publication Citadel21, confirmed a similar incident. The site's operator, known as hodlonaut, indicated that while their Lightning node was breached, only minimal funds had been stored there.
This attack on BTCPayserver users is ongoing. Our Citadel21 node was swept, but we had taken preventive measures, so the losses were minor.
This incident follows a separate theft on July 31, where 594.48 BTC, approximately $38.2 million, was stolen from around 500 Coldcard hardware wallet users, highlighting ongoing security challenges in the cryptocurrency space.
